yichen-codex-chatgpt
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from web searches and ChatGPT Pro responses, which are treated as untrusted. It mitigates injection risks by using a specialized message envelope with unique task IDs and cryptographically random reply markers to ensure instructions are not manipulated during transit.
- Ingestion points: Untrusted data enters the agent context through browser sessions and web research results (references/research.md, references/browser-session.md).
- Boundary markers: The skill uses a custom C2C envelope and random reply markers (e.g., [[C2C_REPLY_]]) to delimit protocol messages (references/c2c-protocol.md).
- Capability inventory: Codex performs local file writes, subprocess execution for orchestration scripts, and browser automation via Computer Use (SKILL.md, references/review.md).
- Sanitization: Strict sanitization rules prevent the logging of raw response data, credentials, or absolute paths; screenshots are cropped to remove account information (references/browser-session.md).
- [COMMAND_EXECUTION]: The skill executes local shell scripts (e.g., tunnel-runtime.zsh and mcp-workspace-launcher.zsh) to manage the secure tunnel and project workspace. These scripts are invoked using paths defined in the user's environment configuration (CODEX_CHATGPT_RUNTIME_ROOT), ensuring the agent operates within defined local boundaries.
- [DYNAMIC_EXECUTION]: Automated UI control of the ChatGPT website is performed via 'Computer Use' and 'Browser Control' skills. The protocol requires explicit action-time user confirmation for every representational message sent to the remote AI, preventing unauthorized automated communication and ensuring human-in-the-loop oversight for browser-based actions.
- [EXTERNAL_DOWNLOADS]: The skill references installation commands for the author's public repository (mcncarl/yichen-skills). These resources are part of the intended delivery and update mechanism for the orchestration framework and originate from the verified vendor.
Audit Metadata